hxxps://www[.]steamtools[.]net/

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.steamtools.net/
Sample260809-yvrxtsvera

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	4816	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4328	st-setup-1.8.30.exe
2112	SteamTools.exe

Loads dropped DLL 21 IoCs

pid	Process
4328	st-setup-1.8.30.exe
4328	st-setup-1.8.30.exe
4328	st-setup-1.8.30.exe
4328	st-setup-1.8.30.exe
4328	st-setup-1.8.30.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3688	icacls.exe
3756	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140.dll	st-setup-1.8.30.exe
File opened for modification	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Widgets.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140_1.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\vcruntime140_1.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\imageformats\qico.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\platforms\qwindows.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Uninstall.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Gui.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Network.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Svg.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\vcruntime140.dll	st-setup-1.8.30.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307796139115506"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{49AAECEA-F912-4090-9160-93E4153BE6CC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2112	SteamTools.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	SteamTools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4328	st-setup-1.8.30.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe
2112	SteamTools.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2756	3964	msedge.exe	85
PID 3964 wrote to memory of 4816	3964	msedge.exe	86
PID 3964 wrote to memory of 3972	3964	msedge.exe	87
PID 3964 wrote to memory of 3972	3964	msedge.exe	87
PID 3964 wrote to memory of 3972	3964	msedge.exe	87
PID 3964 wrote to memory of 4960	3964	msedge.exe	88
PID 3964 wrote to memory of 4960	3964	msedge.exe	88
PID 3964 wrote to memory of 3700	3964	msedge.exe	89
PID 3964 wrote to memory of 3224	3964	msedge.exe	90
PID 3964 wrote to memory of 3700	3964	msedge.exe	89
PID 3964 wrote to memory of 3700	3964	msedge.exe	89
PID 3964 wrote to memory of 3224	3964	msedge.exe	90
PID 3964 wrote to memory of 3224	3964	msedge.exe	90
PID 3964 wrote to memory of 1560	3964	msedge.exe	92
PID 3964 wrote to memory of 4660	3964	msedge.exe	93
PID 3964 wrote to memory of 1560	3964	msedge.exe	92
PID 3964 wrote to memory of 1560	3964	msedge.exe	92
PID 3964 wrote to memory of 4660	3964	msedge.exe	93
PID 3964 wrote to memory of 4660	3964	msedge.exe	93
PID 3964 wrote to memory of 4136	3964	msedge.exe	97
PID 3964 wrote to memory of 4136	3964	msedge.exe	97
PID 3964 wrote to memory of 3184	3964	msedge.exe	98
PID 3964 wrote to memory of 3184	3964	msedge.exe	98
PID 3964 wrote to memory of 4596	3964	msedge.exe	100
PID 3964 wrote to memory of 3480	3964	msedge.exe	101
PID 3964 wrote to memory of 2432	3964	msedge.exe	102
PID 3964 wrote to memory of 3480	3964	msedge.exe	101
PID 3964 wrote to memory of 2432	3964	msedge.exe	102
PID 3964 wrote to memory of 2432	3964	msedge.exe	102
PID 3964 wrote to memory of 4988	3964	msedge.exe	103
PID 3964 wrote to memory of 4328	3964	msedge.exe	104
PID 4328 wrote to memory of 3688	4328	st-setup-1.8.30.exe	106
PID 4328 wrote to memory of 3756	4328	st-setup-1.8.30.exe	108
PID 4328 wrote to memory of 3804	4328	st-setup-1.8.30.exe	111
PID 3320 wrote to memory of 2112	3320	explorer.exe	113
PID 3964 wrote to memory of 3608	3964	msedge.exe	127
PID 3964 wrote to memory of 3708	3964	msedge.exe	128
PID 3964 wrote to memory of 3688	3964	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.steamtools.net/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8709ec188,0x7ff8709ec194,0x7ff8709ec1a0
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16251245304018985639,10793208754914544802,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,15160283304966750038,10358676853893547313,262144 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,5371690063836412805,4778089321741398006,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3443667463296560026,10580863302190184207,2097152 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5441224034550550621,13498839263550400054,2097152 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8645649030473432573,14389949714444961404,2097152 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,5935333867421615893,9790179667958545036,2097152 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,18092146543455083862,13327179293643000041,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5168216033349432163,5054407474145245250,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9159412772783871964,1220132280585606443,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9159412772783871964,1220132280585606443,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8501046603312582112,12938189985542767383,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6468,i,16108395191250371412,6802525491159900917,2097152 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,18411272064552596260,12032455666681954637,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:4988
- C:\Users\Admin\Downloads\st-setup-1.8.30.exe
  "C:\Users\Admin\Downloads\st-setup-1.8.30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
    3⤵
    - Modifies file permissions
    PID:3688
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
    3⤵
    - Modifies file permissions
    PID:3756
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
    3⤵
    PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8484497919892279664,1756471589482890108,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=636 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,13641169762555753605,17077950279170049691,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16052164854108821462,3203449059255669043,524288 --field-trial-handle=2852,i,8184067259450684406,1081983340207612387,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files\SteamTools\SteamTools.exe
  "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Core.dll

Path C:\Program Files\SteamTools\Core.dll
Size 657KB
SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
MD5 a0f3f5d8aedd622aaebc9251e10c15ed
SHA1 271d2c2362f979d47b79acee65cc4ef7b152343e
SHA512 5788813567c26c8a70f6a4369085790a49c44c02a706d7b5bcec68b98ba773598840bd57068aef34fa4c0a25ee5305ce7293335921e33fd25f92c664eb4dd72f
SSDEEP 12288:JuigyYF+iXvJAarykqB4YbiKxXiVncYNCdJqgmVKcfK12:Ju7LciXBAaTe4JKxXiBREdJNma0
TLSH
T17DE48E56B3F400B9D5A7C138CA534517E7B3B4551320ABDB07A09ABA2F23BE1673E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\SteamTools\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\SteamTools\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\SteamTools\Qt5Network.dll
Size 1.3MB
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
TLSH
T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\SteamTools\Qt5Svg.dll
Size 322KB
SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 03761f923e52a7269a6e3a7452f6be93
SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
TLSH
T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\SteamTools\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamTools.exe

Path C:\Program Files\SteamTools\SteamTools.exe
Size 1.7MB
SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
TLSH
T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\SteamTools\imageformats\qico.dll
Size 37KB
SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
MD5 a9abd4329ca364d4f430eddcb471be59
SHA1 c00a629419509929507a05aebb706562c837e337
SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
TLSH
T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\SteamTools\msvcp140.dll
Size 612KB
SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
MD5 ba72c2f6f465926980adc2fb7f8b3490
SHA1 63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
SHA512 05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
SSDEEP 12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh
TLSH
T173D41A27AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files\SteamTools\msvcp140_1.dll
Size 30KB
SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
MD5 18a6c1a3d630dfcbc227082d5b06681a
SHA1 6634a25660e5843cf7fba6dc09b9dfcb698432a5
SHA512 5716e41de4f2ed7fee286c898411d99e11392f60df91b2423539c51016a7b9a12945087e6d1a47256c084ceb06556334ef03e34a8647d704582abe5745292581
SSDEEP 384:NlKX7EGOdlBJkQhnlVI/GD2Wcg53Wco+F0GftpBjLHc4HRN7hlI5e368:nKoBJkQhlVl3v+ixBIe68
TLSH
T132D25B86FB6C8983E8535C7092A5CE83BC3DF3C25B21965B1265E29D1CE37D0AB34619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\SteamTools\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\SteamTools\vcruntime140.dll
Size 83KB
SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
MD5 0c583614eb8ffb4c8c2d9e9880220f1d
SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
TLSH
T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\SteamTools\vcruntime140_1.dll
Size 43KB
SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
MD5 3b22b2ec303b0721827dd768c87df6ed
SHA1 86f8af095cf7368ccbff2d0fd6d33586145acd2b
SHA512 79db774980ee132797f7e7dbc0e055b724d8fbf0e4917523b285f918730adfff81022cc6f5e15469b011d55501fd7b085bc070e9ecdfb75c05f4d6622a7f2475
SSDEEP 384:GRiuauREnUUWU55vZvS05fJjPg2h1RWmbzA+XfAXxy85xH0f9lWrGKWVQRpBj0HP:DJnUUV7xPg4RdPvv2DHkR+W+1CP
TLSH
T1F6135B54977C8486E56B85B0C4A2CF27FE39F6925710928F0B65D29C2E537C0E73D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 608a87c62a6606eb012ee118c56d8e05c439a6fc5322e35aa73978e0f3943e13
MD5 046e390e3ecb95a96535da624f302983
SHA1 dfebf21e52b387ef34601971c11e16f1f9f41d4c
SHA512 8b7ed0d3dfb95b78741c6771abcbcc72e74fb9e148ae1e57b0b89c9aef3522977054287fbf0362181eef1b474a74887d9443cc392d0d8cd11d5ae2468d4d1839
TLSH
T1DA716C730202B8E4EB324273A7D21744743746E9FE6BDE577CA0BBB81A4635DE01812E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586387.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586387.TMP
Size 3KB
SHA256 e0a54be4d9d1b263d6c718fdd45953173b769fbff99c672e6ca182690ab89d38
MD5 cf010551af56d2be60b328aea95d20fd
SHA1 e8dd02c584cb683a93e3d528088e14383fcfe49c
SHA512 1b9e0039581e622fceab60c37a8acd16585ecb1136b200cb48b6d463030751dfef38f0a3223578ceefb12791fa4e95f91923380ace9574185b8c14520422e095
TLSH
T162615C73021238E4EB324273A7D22744747746D8FE67DE677C907BB81A4535DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1942357564072c2effaa0429acd3c3751ebe8481595ad6685f0294c69e9b424d
MD5 1f45765fd39fa99df0504d9bb935c02a
SHA1 f458bc425f597c7b61ae320c9db175d9452327e5
SHA512 49d358ceb351c2307b72f2a0a97eaf7d7c01fe1c108d9014d28b105245159f5d32299d920f8252f63457c9ae6e1024bc1f4a7e9ca557d55222d4777eb38b9fdf
SSDEEP 192:sxZHRvyM/jK1Ml8M9F/fFXsMwuVHIdpRBHW6+WNF08/YvlnjymIgrJ:sxZHd1F/f9sMwRXHb1/Ir9
TLSH
T1B142D711AA34A977CCCBD20DFA51BF53D6F51462E2901E54AAFCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 867e7d82fb19751920bb3e17e7f7507439864bacbfd7273c270dfe122fc13006
MD5 6e8920302b5dceea653cc965bf515b6c
SHA1 266bbcd2c6d24d10eea4d07124ccfa105c5c74e1
SHA512 8d8a84b60599aaec0040736e17c5d7b4ff22945f824ac95deca5fa05d42669ab657b5feed761621e7d4259f7920a1be96826c836c14aae4717b2940fa7744456
SSDEEP 768:rbseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppkro9+:rbseJ3xWvhfwnu1jaVcL88pvA
TLSH
T12FE20B2B280CCB7E4F844E6DEC2A6F966EE801CB67944D5447EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 936cfb0e78a746a972c3f507853d0913ae804daa5011d4f5dd1a43e828d17ffa
MD5 bf50deebe3d76dcfd273ed552bfc24ca
SHA1 6ede188d8b10ba7a56b7f639a992ab9e50d114f1
SHA512 f75c2dbe7f747fcc89a4ec6170af18568772e075c02bf81ae98d9aa020272915cd4b48296eeee0f3a71242ff55e778cb2dfbef36279901ea9ddf12ea77f21308
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnC+IKXKyC:49zTPfC
TLSH
T1B191521232BE12023C7F648CA29A957B9E4136A334DC746FBBA804554F67E119EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 701541cb7159cc73624bc808316675f56d5204a0e82242ffcbf35ebc8ad683cd
MD5 f9b74da09ed334f98e574635bda9df60
SHA1 0963592e31c74464a543a865f784460d8d5a87f8
SHA512 ba8af84b6958e61dc0299379e79ffc0209a091aff5f7637dee359b4ff6b1ea132b244cc8394c1f4d3dbb9c2daddbaeb9e9c3a0324079235ce13efbb82e626627
TLSH
T1532144D0D3ED20949E8AFAC5C31E6447E1B17A1B128D9831731F50F45FC881A8A2ED31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 26a1989ab48ce6be8112fba6a59e7b85a7cf5f6adff13b440af29b078258d595
MD5 35b009fab750b11f7630c8cec719608b
SHA1 2872032819b743137535abba20e13a77b8aeb605
SHA512 a90b8ac4b038743c3de31f237c903bd5eaea100f610d3a4a3f8aa0575cfce3232164ef4a330bfa7385b1e6b88314d1bb78e761f7cca8140377aab74bf73efed9
SSDEEP 192:O2m+xasuheOwQxMGsN6aQbDj+JM7fXKrQmiU1csbB4MTxQClqyNa8z1zqGAsYy:oZcIhsN6aIt7Sd3buIlvztAm
TLSH
T1DD625C72AC74597BA9E7F245F48A33035EF4906BE2C45B50E6EC7F1D00DA558130A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c905028235b580e1de718daee184485d6fb313312329a0cbc02aedca1bf57008
MD5 5e5591062e2470c7fb2f02779e609de6
SHA1 99547c642f5c29d0d12e7cd05286fe2da3053e96
SHA512 9f0e48f35ed21af6c243437853547c3ca6877c9e000c0f4e66e6bdf022cf5c0b4ce75c6904dc976b99f77339b7a497661763da94a8d82156c8fd7450d18d153a
SSDEEP 192:REONT6vMpKPQmiUyLQOhTxQClqyNH80IzqGU/u:CONT6U0RBOblvYtU/u
TLSH
T12F120A76ACB89C6BAE93A581F48A23075EB0916BE9C49F50EADC3F1C01EB55C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 698b3006c466aab9edb8382161efc46af3acea6c2d985582f808614b2ea2bd9d
MD5 cc03aec6e4fdb6a06f9fbcda48766cd5
SHA1 aea2d569016b1c6d97aa0f6f17cbf1950c315ff0
SHA512 c33750f5151577cc12a84960f35ca2e42611b4b597d909d906da0513e29a1d3a1646a3b536be0b2e996bb3c0a1bd4abf42b2906f34386209b38fd6522aa89925
SSDEEP 192:O2f+xasuheOwQxM8sN6YFQbDj+JM7fXKBQmiU1csbB4MTxQClqyNM8z1zqGAsYy:lZcILsN6eIt7Sf3buIlvNtAm
TLSH
T1C8624C72ACB49D7BA9E7E245F48A33035EF4806BE2C45F50E6EC7F1D01DA558130A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 32e5af6936375b94b0e04e39ae5259ebeb4f41527fa0294bf33b3cc85b1c6695
MD5 9caec31ded1a6ffa7989b9876443ea94
SHA1 402261a079ab9015244fab5f580ad9ce7e22db82
SHA512 cd18a4d5d28ea9083b529bc8ff7b03b78b987a7e0edc7d2c0ec5092b179aa760c922a98b9032cb535989740c804d297047760adb24247742afa1aa1d4f3563e7
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop5aOD8BjPYvlCr5pgz6qNGemL5XuB:lONP6vMtPQmiUy7QThTxQClT8472LU/u
TLSH
T16F02E835AC786C7BEAA7AD49F48A23172FF4606FA5905B50EAE82F1C00D765C1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e10ebc6b88542e05288d29abc3693fe8d3004f119ffe8bd2a330cc7a2f5b9b48
MD5 293aae8b8da23b33f214ecc0d9d93444
SHA1 e654d1c857c9ce7f092818edc1af65289a346c2c
SHA512 60217e1df2a3397f6dae115e351011ce85eefad9620dbdfefc1d6aded742cd3c45244202e7621bf138193ed27f647efc2926b8272d7e7dad8065891a3f574596
SSDEEP 192:F2O+xasuheOwQxMBsN6Y6QbDj+JM7fXKBQmiU1csbB4MTxQClqyNM8z1zqGAsYy:pZcIWsN6vIt7Sf3buIlvNtAm
TLSH
T1A0724B716CB45D7AA9E7F145F48A33035EB4806BE2C45F60E6EC7F1D00DA558130A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e75d5e67c5237caef9b01b76450dc970175e08b875e9141cb4e6f4c231cd38e8
MD5 b45c44552c329548d8fadb0e749d52e5
SHA1 0e65f150fd34bdd6abbe62072d69e3338a1118be
SHA512 c1b8cbddcb5d204f11e5044a3ac60ba2bde88af563c25801d732569c6c50ccd46e1fec393819d2ef6f5ea8ebdf5bc7bade1f18261a7cb70a72dd2a035c382f9e
TLSH
T16C41D858B6E90054B3B76F56DBF6A8AE487BB9772E06D55E00110E4E0A23F41CCA1733
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf398A.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsf398A.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf398A.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf398A.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st-setup-1.8.30.exe.crdownload

Path C:\Users\Admin\Downloads\st-setup-1.8.30.exe.crdownload
Size 10.6MB
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-287-0x00007FF86BD90000-0x00007FF86C2D1000-memory.dmp

Download

memory/2112-314-0x000001855D310000-0x000001855D8D6000-memory.dmp

Download

memory/2112-326-0x000001855D310000-0x000001855D8D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads